@de-otio/trellis 0.10.11 → 0.11.0

package/dist/lib/realtime/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/realtime/types.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAMhE;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR,cAAc,GACd,QAAQ,GACR,SAAS,GACT,QAAQ,CAAC;AAEb,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,WAAW,CAAC;IAClB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,SAAS,CAAC;IACrB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAMD,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,GACnB;IACE,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,eAAe,GAAG,cAAc,GAAG,iBAAiB,CAAC;CAC9D,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,gBAAgB,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,GAAG,EAAE,IAAI,CAAC;IACV,UAAU,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACtC;AAED,0DAA0D;AAC1D,MAAM,MAAM,gBAAgB,GACxB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IACE,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EAAE,YAAY,GAAG,aAAa,GAAG,gBAAgB,GAAG,OAAO,CAAC;CACnE,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,WAAW,CAAC;IAClB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,CAAC,EAAE,cAAc,GAAG,UAAU,CAQ1D;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,CAAC,EAAE,UAAU,GAAG,cAAc,CA6B1D;AAMD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GACnC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACjE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC;AAEtD;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACtE,GAAG,CACD,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,aAAa,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,SAAS,CAAC,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CACd,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;CAClC;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,YAAY,GAClB,KAAK,IAAI,YAAY,GAAG,iBAAiB,CAI3C;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAAC;IAClD,mFAAmF;IACnF,OAAO,CACL,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC7E,UAAU,CACR,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,aAAa,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,SAAS,CAAC,CAAC;IACtB,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,2EAA2E;AAC3E,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,GAAG,EAAE,eAAe,GAAG,gBAAgB,CAAC;CAChD"}

package/dist/lib/realtime/types.js

@@ -0,0 +1,61 @@
+// CONTRACT: stable — coordinate changes.
+//
+// This file is the FROZEN WS1 contract for the Trellis RealtimeTransport seam.
+// Every other workstream (WS2 AppSync infra, WS3 authorizer, WS4 push, WS5
+// settings-sync, WS7 conformance) and the Skybber Flutter client bind to the
+// exact signatures below. Any change after WS1 merges is a BREAKING change
+// requiring a coordinated version bump and re-fan-out. See
+// plans/appsync-skybber/00b-integration-and-frozen-contract.md §2.
+//
+// HARD RULE: nothing in apps/api/src/lib/realtime/** may import an AWS SDK
+// (`@aws-sdk/*`, `aws-appsync`, `aws-amplify`) or a socket library. Enforced by
+// test/unit/realtime/no-aws-import.test.ts.
+/** Encode a wakeup envelope to its canonical content-free byte form. */
+export function encodeWakeup(e) {
+    if (e.v !== 1) {
+        throw new Error(`encodeWakeup: unsupported version ${String(e.v)}`);
+    }
+    // Canonical, field-ordered JSON — no free-form passthrough.
+    const canonical = { v: 1, kind: e.kind };
+    if (e.changeToken !== undefined)
+        canonical.changeToken = e.changeToken;
+    return new TextEncoder().encode(JSON.stringify(canonical));
+}
+/** Decode a wakeup envelope. Throws on unknown fields or malformed input. */
+export function decodeWakeup(b) {
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder().decode(b));
+    }
+    catch {
+        throw new Error("decodeWakeup: not valid JSON");
+    }
+    if (typeof parsed !== "object" || parsed === null) {
+        throw new Error("decodeWakeup: not an object");
+    }
+    const obj = parsed;
+    const allowed = new Set(["v", "kind", "changeToken"]);
+    for (const key of Object.keys(obj)) {
+        if (!allowed.has(key)) {
+            throw new Error(`decodeWakeup: unknown field "${key}"`);
+        }
+    }
+    if (obj.v !== 1) {
+        throw new Error("decodeWakeup: unsupported version");
+    }
+    if (typeof obj.kind !== "string") {
+        throw new Error("decodeWakeup: missing/invalid kind");
+    }
+    if (obj.changeToken !== undefined && typeof obj.changeToken !== "string") {
+        throw new Error("decodeWakeup: invalid changeToken");
+    }
+    const env = { v: 1, kind: obj.kind };
+    if (obj.changeToken !== undefined)
+        env.changeToken = obj.changeToken;
+    return env;
+}
+/** Narrowing helper: does this store also provide the change-cursor capability? */
+export function supportsChangeCursor(store) {
+    return (typeof store.listChangedSince === "function");
+}
+//# sourceMappingURL=types.js.map

package/dist/lib/realtime/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/realtime/types.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,2DAA2D;AAC3D,mEAAmE;AACnE,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,4CAA4C;AAuI5C,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAAC,CAAiB;IAC5C,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,4DAA4D;IAC5D,MAAM,SAAS,GAA4B,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACvE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,CAAa;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,GAAG,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAmB,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAmB,EAAE,CAAC;IACpE,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAkFD,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAClC,KAAmB;IAEnB,OAAO,CACL,OAAQ,KAAoC,CAAC,gBAAgB,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC"}

package/dist/lib/routes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwDH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAsPxC,eAAO,MAAM,MAAM,EAAE,KAAK,EAkBzB,CAAC;AAGF,YAAY,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAyDH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAwPxC,eAAO,MAAM,MAAM,EAAE,KAAK,EAkBzB,CAAC;AAGF,YAAY,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC"}

package/dist/lib/routes/index.js

@@ -62,6 +62,7 @@ import { productTaxonomyRoutes } from "./products.js";
 import { notificationsRoutes } from "./notifications.js";
 import { parentalControlRoutes } from "./parental-controls.js";
 import { sentimentsRoutes } from "./sentiments.js";
+import { settingsRoutes } from "./settings.js";
 import { taxonomyRoutes } from "./taxonomy.js";
 import { taxonomyAnalyticsRoutes } from "./taxonomy-analytics.js";
 import { tenantRoutes } from "./tenants.js";
@@ -169,6 +170,8 @@ const coreRoutes = [
     ...commentsRoutes,
     // Sentiments/Reactions
     ...sentimentsRoutes,
+    // Realtime / server-blind settings sync
+    ...settingsRoutes,
     // Media uploads
     ...mediaRoutes,
     // Media metadata privacy controls

package/dist/lib/routes/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,UAAU,IAAI,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,IAAI,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,MAAe;IACrC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,OAAO,GAAG,CAAC,KAAY,EAAW,EAAE,CACxC,kBAAkB;IAClB,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAErE;;;GAGG;AACH,MAAM,UAAU,GAAY;IAC1B,8CAA8C;IAC9C,GAAG,YAAY;IAEf,2EAA2E;IAC3E,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAErC,iBAAiB;IACjB,GAAG,UAAU;IAEb,kDAAkD;IAClD,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAErC,oCAAoC;IACpC,GAAG,SAAS;IAEZ,0BAA0B;IAC1B,GAAG,UAAU;IAEb,4BAA4B;IAC5B,GAAG,cAAc,CAAC,YAAY,CAAC;IAE/B,6BAA6B;IAC7B,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAErC,kCAAkC;IAClC,GAAG,cAAc,CAAC,eAAe,CAAC;IAElC,0CAA0C;IAC1C,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAErC,8BAA8B;IAC9B,GAAG,cAAc,CAAC,uBAAuB,CAAC;IAE1C,mBAAmB;IACnB,GAAG,cAAc,CAAC,iBAAiB,CAAC;IAEpC,mCAAmC;IACnC,GAAG,cAAc,CAAC,sBAAsB,CAAC;IAEzC,8BAA8B;IAC9B,GAAG,cAAc,CAAC,iBAAiB,CAAC;IAEpC,uDAAuD;IACvD,GAAG,cAAc,CAAC,WAAW,CAAC;IAE9B,4CAA4C;IAC5C,GAAG,cAAc,CAAC,oBAAoB,CAAC;IAEvC,6CAA6C;IAC7C,GAAG,cAAc,CAAC,mBAAmB,CAAC;IAEtC,yBAAyB;IACzB,GAAG,kBAAkB;IAErB,0EAA0E;IAC1E,GAAG,yBAAyB;IAE5B,6DAA6D;IAC7D,GAAG,eAAe;IAClB,GAAG,WAAW;IAEd,4EAA4E;IAC5E,GAAG,eAAe;IAElB,SAAS;IACT,GAAG,YAAY;IAEf,YAAY;IACZ,GAAG,eAAe;IAElB,cAAc;IACd,GAAG,iBAAiB;IAEpB,MAAM;IACN,GAAG,SAAS;IAEZ,mDAAmD;IACnD,GAAG,cAAc;IAEjB,QAAQ;IACR,GAAG,WAAW;IAEd,QAAQ;IACR,GAAG,WAAW;IAEd,WAAW;IACX,GAAG,cAAc;IAEjB,uBAAuB;IACvB,GAAG,gBAAgB;IAEnB,gBAAgB;IAChB,GAAG,WAAW;IAEd,kCAAkC;IAClC,GAAG,6BAA6B;IAEhC,6CAA6C;IAC7C,GAAG,mBAAmB;IAEtB,4BAA4B;IAC5B,GAAG,mBAAmB;IAEtB,sBAAsB;IACtB,GAAG,aAAa;IAEhB,sCAAsC;IACtC,GAAG,mBAAmB;IAEtB,0CAA0C;IAC1C,GAAG,qBAAqB;IAExB,cAAc;IACd,GAAG,YAAY;IAEf,mBAAmB;IACnB,GAAG,cAAc;IAEjB,0BAA0B;IAC1B,GAAG,gBAAgB;IAEnB,qDAAqD;IACrD,GAAG,kBAAkB;IAErB,0BAA0B;IAC1B,GAAG,YAAY;IAEf,0CAA0C;IAC1C,GAAG,wBAAwB;IAE3B,mBAAmB;IACnB,GAAG,oBAAoB;IAEvB,YAAY;IACZ,GAAG,eAAe;IAElB,WAAW;IACX,GAAG,cAAc;IAEjB,oBAAoB;IACpB,GAAG,sBAAsB;IAEzB,qBAAqB;IACrB,GAAG,uBAAuB;IAE1B,wBAAwB;IACxB,GAAG,qBAAqB;IAExB,gBAAgB;IAChB,GAAG,kBAAkB;IAErB,eAAe;IACf,GAAG,gBAAgB;IAEnB,+DAA+D;IAC/D,GAAG,SAAS;IAEZ,qEAAqE;IACrE,gFAAgF;IAChF,8EAA8E;IAC9E,+EAA+E;IAC/E,+CAA+C;IAC/C,GAAG,CAAC,kBAAkB;QACpB,CAAC,CAAC;YACE,GAAG,eAAe;YAClB,GAAG,WAAW;YACd,GAAG,WAAW;YACd,GAAG,YAAY;YACf,GAAG,aAAa;YAChB,GAAG,WAAW;YACd,GAAG,gBAAgB;YACnB,GAAG,mBAAmB;YACtB,GAAG,qBAAqB;SACzB;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,2EAA2E;IAC3E,wEAAwE;IACxE,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;IAEhC,0EAA0E;IAC1E,kDAAkD;IAClD,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC;CAClC,CAAC;AAEF,kDAAkD;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpE,MAAM,eAAe,GAAY;IAC/B,gDAAgD;IAChD,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAiB,CAAC;IAC1D,+EAA+E;IAC/E,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAY;IAC7B,GAAG,UAAU;IACb,GAAG,eAAe;IAElB,6BAA6B;IAC7B;QACE,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;YACjD,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,UAAU,EAAE,CAAC,cAAc,EAAE,CAAC;QAC9B,WAAW,EAAE,eAAe;KAC7B;CACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,UAAU,IAAI,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,IAAI,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,MAAe;IACrC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,OAAO,GAAG,CAAC,KAAY,EAAW,EAAE,CACxC,kBAAkB;IAClB,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAErE;;;GAGG;AACH,MAAM,UAAU,GAAY;IAC1B,8CAA8C;IAC9C,GAAG,YAAY;IAEf,2EAA2E;IAC3E,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAErC,iBAAiB;IACjB,GAAG,UAAU;IAEb,kDAAkD;IAClD,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAErC,oCAAoC;IACpC,GAAG,SAAS;IAEZ,0BAA0B;IAC1B,GAAG,UAAU;IAEb,4BAA4B;IAC5B,GAAG,cAAc,CAAC,YAAY,CAAC;IAE/B,6BAA6B;IAC7B,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAErC,kCAAkC;IAClC,GAAG,cAAc,CAAC,eAAe,CAAC;IAElC,0CAA0C;IAC1C,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAErC,8BAA8B;IAC9B,GAAG,cAAc,CAAC,uBAAuB,CAAC;IAE1C,mBAAmB;IACnB,GAAG,cAAc,CAAC,iBAAiB,CAAC;IAEpC,mCAAmC;IACnC,GAAG,cAAc,CAAC,sBAAsB,CAAC;IAEzC,8BAA8B;IAC9B,GAAG,cAAc,CAAC,iBAAiB,CAAC;IAEpC,uDAAuD;IACvD,GAAG,cAAc,CAAC,WAAW,CAAC;IAE9B,4CAA4C;IAC5C,GAAG,cAAc,CAAC,oBAAoB,CAAC;IAEvC,6CAA6C;IAC7C,GAAG,cAAc,CAAC,mBAAmB,CAAC;IAEtC,yBAAyB;IACzB,GAAG,kBAAkB;IAErB,0EAA0E;IAC1E,GAAG,yBAAyB;IAE5B,6DAA6D;IAC7D,GAAG,eAAe;IAClB,GAAG,WAAW;IAEd,4EAA4E;IAC5E,GAAG,eAAe;IAElB,SAAS;IACT,GAAG,YAAY;IAEf,YAAY;IACZ,GAAG,eAAe;IAElB,cAAc;IACd,GAAG,iBAAiB;IAEpB,MAAM;IACN,GAAG,SAAS;IAEZ,mDAAmD;IACnD,GAAG,cAAc;IAEjB,QAAQ;IACR,GAAG,WAAW;IAEd,QAAQ;IACR,GAAG,WAAW;IAEd,WAAW;IACX,GAAG,cAAc;IAEjB,uBAAuB;IACvB,GAAG,gBAAgB;IACnB,wCAAwC;IACxC,GAAG,cAAc;IAEjB,gBAAgB;IAChB,GAAG,WAAW;IAEd,kCAAkC;IAClC,GAAG,6BAA6B;IAEhC,6CAA6C;IAC7C,GAAG,mBAAmB;IAEtB,4BAA4B;IAC5B,GAAG,mBAAmB;IAEtB,sBAAsB;IACtB,GAAG,aAAa;IAEhB,sCAAsC;IACtC,GAAG,mBAAmB;IAEtB,0CAA0C;IAC1C,GAAG,qBAAqB;IAExB,cAAc;IACd,GAAG,YAAY;IAEf,mBAAmB;IACnB,GAAG,cAAc;IAEjB,0BAA0B;IAC1B,GAAG,gBAAgB;IAEnB,qDAAqD;IACrD,GAAG,kBAAkB;IAErB,0BAA0B;IAC1B,GAAG,YAAY;IAEf,0CAA0C;IAC1C,GAAG,wBAAwB;IAE3B,mBAAmB;IACnB,GAAG,oBAAoB;IAEvB,YAAY;IACZ,GAAG,eAAe;IAElB,WAAW;IACX,GAAG,cAAc;IAEjB,oBAAoB;IACpB,GAAG,sBAAsB;IAEzB,qBAAqB;IACrB,GAAG,uBAAuB;IAE1B,wBAAwB;IACxB,GAAG,qBAAqB;IAExB,gBAAgB;IAChB,GAAG,kBAAkB;IAErB,eAAe;IACf,GAAG,gBAAgB;IAEnB,+DAA+D;IAC/D,GAAG,SAAS;IAEZ,qEAAqE;IACrE,gFAAgF;IAChF,8EAA8E;IAC9E,+EAA+E;IAC/E,+CAA+C;IAC/C,GAAG,CAAC,kBAAkB;QACpB,CAAC,CAAC;YACE,GAAG,eAAe;YAClB,GAAG,WAAW;YACd,GAAG,WAAW;YACd,GAAG,YAAY;YACf,GAAG,aAAa;YAChB,GAAG,WAAW;YACd,GAAG,gBAAgB;YACnB,GAAG,mBAAmB;YACtB,GAAG,qBAAqB;SACzB;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,2EAA2E;IAC3E,wEAAwE;IACxE,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;IAEhC,0EAA0E;IAC1E,kDAAkD;IAClD,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC;CAClC,CAAC;AAEF,kDAAkD;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpE,MAAM,eAAe,GAAY;IAC/B,gDAAgD;IAChD,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAiB,CAAC;IAC1D,+EAA+E;IAC/E,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAY;IAC7B,GAAG,UAAU;IACb,GAAG,eAAe;IAElB,6BAA6B;IAC7B;QACE,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;YACjD,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,UAAU,EAAE,CAAC,cAAc,EAAE,CAAC;QAC9B,WAAW,EAAE,eAAe;KAC7B;CACF,CAAC"}

package/dist/lib/routes/settings.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Encrypted Settings Routes (WS5 — state-sync).
+ *
+ * GET/PUT /api/settings/:namespace — server-blind, session-scoped sync of a
+ * user's per-namespace encrypted setting blob.
+ *
+ * Security posture:
+ *  - Session-scoped to `session.userId`; a user can only read/write THEIR OWN
+ *    blob. The blob has no tenantId — `auth.activeTenantId` is used only to
+ *    scope the publish-on-change realtime channel.
+ *  - Server-blind: the ciphertext is never parsed or logged.
+ *  - Optimistic concurrency: stale version -> 409 with current; If-None-Match
+ *    matching the current version -> 304.
+ */
+import type { Route } from "./types.js";
+export declare const settingsRoutes: Route[];
+//# sourceMappingURL=settings.d.ts.map

package/dist/lib/routes/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAqBH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAqCxC,eAAO,MAAM,cAAc,EAAE,KAAK,EAqMjC,CAAC"}

package/dist/lib/routes/settings.js

@@ -0,0 +1,187 @@
+/**
+ * Encrypted Settings Routes (WS5 — state-sync).
+ *
+ * GET/PUT /api/settings/:namespace — server-blind, session-scoped sync of a
+ * user's per-namespace encrypted setting blob.
+ *
+ * Security posture:
+ *  - Session-scoped to `session.userId`; a user can only read/write THEIR OWN
+ *    blob. The blob has no tenantId — `auth.activeTenantId` is used only to
+ *    scope the publish-on-change realtime channel.
+ *  - Server-blind: the ciphertext is never parsed or logged.
+ *  - Optimistic concurrency: stale version -> 409 with current; If-None-Match
+ *    matching the current version -> 304.
+ */
+import { authMiddleware } from "../auth/auth-middleware.js";
+import { createPrisma } from "../../db.js";
+import { BlobTooLargeError, UnknownNamespaceError, } from "../encrypted-settings/types.js";
+import { EncryptedSettingsHandler } from "../encrypted-settings/encrypted-settings-handler.js";
+import { PrismaEncryptedSettingsStore } from "../encrypted-settings/encrypted-settings-store.js";
+import { resolveSettingsConfig } from "../encrypted-settings/config.js";
+import { getLogger } from "../logger.js";
+import { corsMiddleware, csrfMiddleware, rateLimitMiddleware, } from "../middleware.js";
+import { SecurityHeaders } from "../security-headers.js";
+import { SessionManager } from "../session-cookie.js";
+import { Validator } from "../validation.js";
+const NAMESPACE_PATTERN = /^\/api\/settings\/([^/]+)$/;
+// Track C — offline backfill cursor. A LITERAL path; it MUST be registered
+// before NAMESPACE_PATTERN so "changes" is never captured as a `:namespace`
+// (Hono runs matching handlers in registration order, first Response wins).
+const CHANGES_PATTERN = /^\/api\/settings\/changes$/;
+/** Parse the opaque `?since=<cursor>` version high-watermark. Missing/invalid
+ *  -> 0 (a full backfill), never throws. The cursor is an opaque integer. */
+function sinceFrom(url) {
+    const raw = url.searchParams.get("since");
+    if (raw === null)
+        return 0;
+    const n = Number.parseInt(raw, 10);
+    return Number.isFinite(n) && n >= 0 ? n : 0;
+}
+/** Extract the `:namespace` path param (decoded). */
+function namespaceFrom(pathname) {
+    const m = pathname.match(NAMESPACE_PATTERN);
+    if (!m)
+        return null;
+    try {
+        return decodeURIComponent(m[1]);
+    }
+    catch {
+        return null;
+    }
+}
+/** Build the handler from resolved Env. The store is Prisma-backed; the
+ *  transport comes from the WS1 seam (poll/noop/injected). */
+function buildHandler(env) {
+    const db = createPrisma(env);
+    const store = new PrismaEncryptedSettingsStore(db);
+    const config = resolveSettingsConfig(env);
+    return new EncryptedSettingsHandler(store, config, env.realtimeTransport);
+}
+export const settingsRoutes = [
+    // GET /api/settings/changes?since=<cursor> — Track C offline-backfill cursor.
+    // Session-scoped; returns METADATA ONLY (never ciphertext) for namespaces whose
+    // version advanced past the cursor. Registered FIRST so the literal "changes"
+    // path wins over the :namespace capture.
+    {
+        path: CHANGES_PATTERN,
+        method: "GET",
+        handler: async (request, env, { url }) => {
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
+            const validator = new Validator();
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
+            if (!session) {
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+            }
+            try {
+                const handler = buildHandler(env);
+                const response = await handler.handleChanges(session.userId, sinceFrom(url));
+                return securityHeaders.addSecurityHeaders(response);
+            }
+            catch (error) {
+                logger.error("Error listing setting changes:", error);
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: validator.sanitizeError(error) }), { status: 500, headers: { "content-type": "application/json" } });
+            }
+        },
+        middleware: [
+            corsMiddleware(),
+            rateLimitMiddleware({ maxRequests: 120, windowMs: 60000 }),
+        ],
+        description: "List setting namespaces changed since a cursor (metadata only)",
+    },
+    // GET /api/settings/:namespace — read the current blob (or 304 if unchanged).
+    {
+        path: NAMESPACE_PATTERN,
+        method: "GET",
+        handler: async (request, env, { pathname }) => {
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
+            const validator = new Validator();
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
+            if (!session) {
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+            }
+            const namespace = namespaceFrom(pathname);
+            if (namespace === null) {
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: "NOT_FOUND" }), { status: 404, headers: { "content-type": "application/json" } });
+            }
+            try {
+                const handler = buildHandler(env);
+                const response = await handler.handleGet(session.userId, namespace, request.headers.get("if-none-match"));
+                return securityHeaders.addSecurityHeaders(response);
+            }
+            catch (error) {
+                if (error instanceof UnknownNamespaceError) {
+                    return securityHeaders.createSecureResponse(JSON.stringify({ error: "NOT_FOUND", message: "Unknown namespace" }), { status: 404, headers: { "content-type": "application/json" } });
+                }
+                logger.error("Error reading encrypted setting:", error);
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: validator.sanitizeError(error) }), { status: 500, headers: { "content-type": "application/json" } });
+            }
+        },
+        middleware: [
+            corsMiddleware(),
+            rateLimitMiddleware({ maxRequests: 120, windowMs: 60000 }),
+        ],
+        description: "Get encrypted setting blob",
+    },
+    // PUT /api/settings/:namespace — write the blob with optimistic concurrency.
+    {
+        path: NAMESPACE_PATTERN,
+        method: "PUT",
+        handler: async (request, env, { pathname }) => {
+            const sessionManager = new SessionManager();
+            const securityHeaders = new SecurityHeaders(env);
+            const logger = getLogger();
+            const validator = new Validator();
+            const session = await sessionManager.getSession(request, env.SESSION_SECRET, env);
+            if (!session) {
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+            }
+            const auth = await authMiddleware(request, env);
+            if (!auth || !auth.activeTenantId) {
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+            }
+            const namespace = namespaceFrom(pathname);
+            if (namespace === null) {
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: "NOT_FOUND" }), { status: 404, headers: { "content-type": "application/json" } });
+            }
+            let body;
+            try {
+                body = await request.json();
+            }
+            catch {
+                return securityHeaders.createSecureResponse(JSON.stringify({
+                    error: "VALIDATION_ERROR",
+                    message: "Invalid JSON body",
+                }), { status: 400, headers: { "content-type": "application/json" } });
+            }
+            try {
+                const handler = buildHandler(env);
+                const response = await handler.handlePut(session.userId, auth.activeTenantId, namespace, body);
+                return securityHeaders.addSecurityHeaders(response);
+            }
+            catch (error) {
+                if (error instanceof UnknownNamespaceError) {
+                    return securityHeaders.createSecureResponse(JSON.stringify({ error: "NOT_FOUND", message: "Unknown namespace" }), { status: 404, headers: { "content-type": "application/json" } });
+                }
+                if (error instanceof BlobTooLargeError) {
+                    return securityHeaders.createSecureResponse(JSON.stringify({
+                        error: "PAYLOAD_TOO_LARGE",
+                        message: "Encrypted setting blob exceeds size limit",
+                    }), { status: 413, headers: { "content-type": "application/json" } });
+                }
+                logger.error("Error writing encrypted setting:", error);
+                return securityHeaders.createSecureResponse(JSON.stringify({ error: validator.sanitizeError(error) }), { status: 500, headers: { "content-type": "application/json" } });
+            }
+        },
+        middleware: [
+            corsMiddleware(),
+            csrfMiddleware(),
+            rateLimitMiddleware({ maxRequests: 30, windowMs: 60000 }),
+        ],
+        description: "Write encrypted setting blob",
+    },
+];
+//# sourceMappingURL=settings.js.map

package/dist/lib/routes/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../src/lib/routes/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,mDAAmD,CAAC;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,cAAc,EACd,cAAc,EACd,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAI7C,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AACvD,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAErD;6EAC6E;AAC7E,SAAS,SAAS,CAAC,GAAQ;IACzB,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,qDAAqD;AACrD,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;8DAC8D;AAC9D,SAAS,YAAY,CAAC,GAAQ;IAC5B,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,4BAA4B,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,IAAI,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAY;IACrC,8EAA8E;IAC9E,gFAAgF;IAChF,8EAA8E;IAC9E,yCAAyC;IACzC;QACE,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YACvC,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;YAC5C,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;YAElC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAC7C,OAAO,EACP,GAAG,CAAC,cAAc,EAClB,GAAG,CACJ,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBAClC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAC1C,OAAO,CAAC,MAAM,EACd,SAAS,CAAC,GAAG,CAAC,CACf,CAAC;gBACF,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;gBACtD,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EACzD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,UAAU,EAAE;YACV,cAAc,EAAE;YAChB,mBAAmB,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;SAC3D;QACD,WAAW,EAAE,gEAAgE;KAC9E;IAED,8EAA8E;IAC9E;QACE,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;YAC5C,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;YAElC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAC7C,OAAO,EACP,GAAG,CAAC,cAAc,EAClB,GAAG,CACJ,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBAClC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CACtC,OAAO,CAAC,MAAM,EACd,SAAS,EACT,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CACrC,CAAC;gBACF,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,EACpE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;gBACxD,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EACzD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,UAAU,EAAE;YACV,cAAc,EAAE;YAChB,mBAAmB,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;SAC3D;QACD,WAAW,EAAE,4BAA4B;KAC1C;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC5C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;YAC5C,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;YAElC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CAC7C,OAAO,EACP,GAAG,CAAC,cAAc,EAClB,GAAG,CACJ,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBAClC,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC;oBACb,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,mBAAmB;iBAC7B,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBAClC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CACtC,OAAO,CAAC,MAAM,EACd,IAAI,CAAC,cAAc,EACnB,SAAS,EACT,IAAI,CACL,CAAC;gBACF,OAAO,eAAe,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBAC3C,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,EACpE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACJ,CAAC;gBACD,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;oBACvC,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,mBAAmB;wBAC1B,OAAO,EAAE,2CAA2C;qBACrD,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;gBACxD,OAAO,eAAe,CAAC,oBAAoB,CACzC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EACzD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,UAAU,EAAE;YACV,cAAc,EAAE;YAChB,cAAc,EAAE;YAChB,mBAAmB,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;SAC1D;QACD,WAAW,EAAE,8BAA8B;KAC5C;CACF,CAAC"}

package/dist/lib/tenant-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-scope.d.ts","sourceRoot":"","sources":["../../src/lib/tenant-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAOH,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE3D,6EAA6E;AAC7E,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,GAAG,SAAyC,GACtD,eAAe,CAEjB;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAuBnD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CA0DtD,CAAC;AAqBH;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAG7D;AAYD,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GACjB;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,GACzB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAChC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEzD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC1C,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,QAAQ,EAAE,OAAO,CAAC;CACnB,GAAG,SAAS,CAqDZ;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe;;;;EAyCzD"}
+{"version":3,"file":"tenant-scope.d.ts","sourceRoot":"","sources":["../../src/lib/tenant-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAOH,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE3D,6EAA6E;AAC7E,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,GAAG,SAAyC,GACtD,eAAe,CAEjB;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAwBnD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CA2DtD,CAAC;AAqBH;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAG7D;AAYD,+EAA+E;AAC/E,MAAM,MAAM,SAAS,GACjB;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,GACzB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAChC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAEzD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC1C,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,QAAQ,EAAE,OAAO,CAAC;CACnB,GAAG,SAAS,CAqDZ;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe;;;;EAyCzD"}

package/dist/lib/tenant-scope.js

@@ -48,6 +48,7 @@ export const TENANT_SCOPED_MODELS = new Set([
     "PostComment",
     "Entity",
     "Notification",
+    "BlockedUser",
     "Group",
     "GroupMember",
     "EntityOwnership",
@@ -100,6 +101,7 @@ export const UNSCOPED_MODELS = new Map([
     ["UploadSession", "user"],
     ["MfaEnrollment", "user"],
     ["UserEncryptionKey", "user"],
+    ["EncryptedUserSetting", "user"],
     ["Consent", "user"],
     ["NotificationPreference", "user"],
     // Generalized report model (Surveillance-hardening Phase 0, E3; folds in the

package/dist/lib/tenant-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-scope.js","sourceRoot":"","sources":["../../src/lib/tenant-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,MAA0B,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAEvD,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,MAAM;IACN,aAAa;IACb,QAAQ;IACR,cAAc;IACd,OAAO;IACP,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAChB,0BAA0B;IAC1B,mBAAmB;IACnB,kBAAkB;IAClB,eAAe;IACf,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,gBAAgB;IAChB,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,cAAc;IACd,oBAAoB;CACrB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAgC,IAAI,GAAG,CAAC;IAClE,8EAA8E;IAC9E,8EAA8E;IAC9E,6DAA6D;IAC7D,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1B,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,wBAAwB,EAAE,cAAc,CAAC;IAC1C,CAAC,mBAAmB,EAAE,cAAc,CAAC;IACrC,CAAC,kBAAkB,EAAE,cAAc,CAAC;IACpC,oBAAoB;IACpB,CAAC,UAAU,EAAE,QAAQ,CAAC;IACtB,CAAC,kBAAkB,EAAE,QAAQ,CAAC;IAC9B,CAAC,kBAAkB,EAAE,QAAQ,CAAC;IAC9B,CAAC,eAAe,EAAE,QAAQ,CAAC;IAC3B,CAAC,aAAa,EAAE,QAAQ,CAAC;IACzB,CAAC,cAAc,EAAE,QAAQ,CAAC;IAC1B,CAAC,WAAW,EAAE,0BAA0B,CAAC;IACzC,gDAAgD;IAChD,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,cAAc,EAAE,MAAM,CAAC;IACxB,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAC3B,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAC1B,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAChC,CAAC,eAAe,EAAE,MAAM,CAAC;IACzB,CAAC,eAAe,EAAE,MAAM,CAAC;IACzB,CAAC,mBAAmB,EAAE,MAAM,CAAC;IAC7B,CAAC,SAAS,EAAE,MAAM,CAAC;IACnB,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAClC,6EAA6E;IAC7E,gEAAgE;IAChE,6EAA6E;IAC7E,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,cAAc,EAAE,MAAM,CAAC;IACxB,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAC5B,CAAC,YAAY,EAAE,MAAM,CAAC;IACtB,CAAC,eAAe,EAAE,WAAW,CAAC;IAC9B,4EAA4E;IAC5E,8EAA8E;IAC9E,CAAC,WAAW,EAAE,aAAa,CAAC;IAC5B,CAAC,eAAe,EAAE,aAAa,CAAC;IAChC,CAAC,aAAa,EAAE,aAAa,CAAC;IAC9B,CAAC,kBAAkB,EAAE,aAAa,CAAC;IACnC,CAAC,kBAAkB,EAAE,aAAa,CAAC;IACnC,CAAC,mBAAmB,EAAE,aAAa,CAAC;IACpC,CAAC,iBAAiB,EAAE,aAAa,CAAC;IAClC,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IAC5C,CAAC,WAAW,EAAE,aAAa,CAAC;IAC5B,CAAC,cAAc,EAAE,aAAa,CAAC;IAC/B,2EAA2E;IAC3E,6BAA6B;IAC7B,CAAC,eAAe,EAAE,gBAAgB,CAAC;IACnC,CAAC,YAAY,EAAE,gBAAgB,CAAC;IAChC,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,WAAW;IACX,kBAAkB;IAClB,UAAU;IACV,OAAO;IACP,WAAW;IACX,SAAS;IACT,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AACH,yEAAyE;AACzE,+EAA+E;AAC/E,6DAA6D;AAE7D,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,eAAe,GAAG,IAAI,iBAAiB,EAAQ,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAI,MAAc,EAAE,EAAW;IACxD,SAAS,EAAE,CAAC,IAAI,CAAC,kDAAkD,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjF,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AACD,SAAS,UAAU;IACjB,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,QAAgB;IAChD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAO/B;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAEnE,IAAI,IAAI,KAAK,KAAK,IAAI,QAAQ,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC;gBACE,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,kBAAkB,KAAK,IAAI,SAAS,6BAA6B;aAC3E;YACH,CAAC,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,CAAC,GAAI,IAAI,EAAE,KAA6C,IAAI,SAAS,CAAC;QAC5E,MAAM,UAAU,GAAG,CAAC,CAClB,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CACzD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IAED,UAAU;IACV,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,GAAI,CAAC,CAAC,IAAe,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAI,CAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnD,CAAC,CAAC,EAAE,GAAI,IAAe,EAAE,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE;gBACJ,GAAG,CAAC;gBACJ,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAClC,MAAM,EAAE,EAAE,GAAI,CAAC,CAAC,MAAiB,EAAE,QAAQ,EAAE;gBAC7C,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB;SACF,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,0BAA0B;IAC1B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,OAAO,MAAM,CAAC,eAAe,CAAC;QAC5B,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE;YACL,UAAU,EAAE;gBACV,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE;oBACpD,MAAM,IAAI,GAAG,eAAe,CAAC;wBAC3B,IAAI;wBACJ,KAAK;wBACL,SAAS;wBACT,IAAI,EAAE,IAA2C;wBACjD,QAAQ,EAAE,kBAAkB,EAAE;wBAC9B,QAAQ,EAAE,UAAU,EAAE;qBACvB,CAAC,CAAC;oBAEH,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;wBACpB,KAAK,aAAa;4BAChB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,OAAO;4BACV,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBAChC,KAAK,oBAAoB;4BACvB,SAAS,EAAE,CAAC,IAAI,CACd,wDAAwD,EACxD,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;4BACF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,SAAS;4BACZ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gCACpB,SAAS,EAAE,CAAC,IAAI,CAAC,yCAAyC,EAAE;oCAC1D,KAAK;oCACL,SAAS;iCACV,CAAC,CAAC;4BACL,CAAC;4BACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,SAAS;4BACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAmB,CAAC,CAAC;oBAC3C,CAAC;gBACH,CAAC;aACF;SACF;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"tenant-scope.js","sourceRoot":"","sources":["../../src/lib/tenant-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,MAA0B,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAEvD,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,MAAM;IACN,aAAa;IACb,QAAQ;IACR,cAAc;IACd,aAAa;IACb,OAAO;IACP,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAChB,0BAA0B;IAC1B,mBAAmB;IACnB,kBAAkB;IAClB,eAAe;IACf,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,gBAAgB;IAChB,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,cAAc;IACd,oBAAoB;CACrB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAgC,IAAI,GAAG,CAAC;IAClE,8EAA8E;IAC9E,8EAA8E;IAC9E,6DAA6D;IAC7D,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1B,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,wBAAwB,EAAE,cAAc,CAAC;IAC1C,CAAC,mBAAmB,EAAE,cAAc,CAAC;IACrC,CAAC,kBAAkB,EAAE,cAAc,CAAC;IACpC,oBAAoB;IACpB,CAAC,UAAU,EAAE,QAAQ,CAAC;IACtB,CAAC,kBAAkB,EAAE,QAAQ,CAAC;IAC9B,CAAC,kBAAkB,EAAE,QAAQ,CAAC;IAC9B,CAAC,eAAe,EAAE,QAAQ,CAAC;IAC3B,CAAC,aAAa,EAAE,QAAQ,CAAC;IACzB,CAAC,cAAc,EAAE,QAAQ,CAAC;IAC1B,CAAC,WAAW,EAAE,0BAA0B,CAAC;IACzC,gDAAgD;IAChD,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,cAAc,EAAE,MAAM,CAAC;IACxB,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAC3B,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAC1B,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAChC,CAAC,eAAe,EAAE,MAAM,CAAC;IACzB,CAAC,eAAe,EAAE,MAAM,CAAC;IACzB,CAAC,mBAAmB,EAAE,MAAM,CAAC;IAC7B,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAChC,CAAC,SAAS,EAAE,MAAM,CAAC;IACnB,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAClC,6EAA6E;IAC7E,gEAAgE;IAChE,6EAA6E;IAC7E,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,cAAc,EAAE,MAAM,CAAC;IACxB,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAC5B,CAAC,YAAY,EAAE,MAAM,CAAC;IACtB,CAAC,eAAe,EAAE,WAAW,CAAC;IAC9B,4EAA4E;IAC5E,8EAA8E;IAC9E,CAAC,WAAW,EAAE,aAAa,CAAC;IAC5B,CAAC,eAAe,EAAE,aAAa,CAAC;IAChC,CAAC,aAAa,EAAE,aAAa,CAAC;IAC9B,CAAC,kBAAkB,EAAE,aAAa,CAAC;IACnC,CAAC,kBAAkB,EAAE,aAAa,CAAC;IACnC,CAAC,mBAAmB,EAAE,aAAa,CAAC;IACpC,CAAC,iBAAiB,EAAE,aAAa,CAAC;IAClC,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IAC5C,CAAC,WAAW,EAAE,aAAa,CAAC;IAC5B,CAAC,cAAc,EAAE,aAAa,CAAC;IAC/B,2EAA2E;IAC3E,6BAA6B;IAC7B,CAAC,eAAe,EAAE,gBAAgB,CAAC;IACnC,CAAC,YAAY,EAAE,gBAAgB,CAAC;IAChC,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,WAAW;IACX,kBAAkB;IAClB,UAAU;IACV,OAAO;IACP,WAAW;IACX,SAAS;IACT,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AACH,yEAAyE;AACzE,+EAA+E;AAC/E,6DAA6D;AAE7D,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM,eAAe,GAAG,IAAI,iBAAiB,EAAQ,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAI,MAAc,EAAE,EAAW;IACxD,SAAS,EAAE,CAAC,IAAI,CAAC,kDAAkD,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjF,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AACD,SAAS,UAAU;IACjB,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,QAAgB;IAChD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAO/B;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAEnE,IAAI,IAAI,KAAK,KAAK,IAAI,QAAQ,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC;gBACE,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,kBAAkB,KAAK,IAAI,SAAS,6BAA6B;aAC3E;YACH,CAAC,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,CAAC,GAAI,IAAI,EAAE,KAA6C,IAAI,SAAS,CAAC;QAC5E,MAAM,UAAU,GAAG,CAAC,CAClB,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CACzD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IAED,UAAU;IACV,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,GAAI,CAAC,CAAC,IAAe,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAI,CAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnD,CAAC,CAAC,EAAE,GAAI,IAAe,EAAE,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE;gBACJ,GAAG,CAAC;gBACJ,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAClC,MAAM,EAAE,EAAE,GAAI,CAAC,CAAC,MAAiB,EAAE,QAAQ,EAAE;gBAC7C,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB;SACF,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,0BAA0B;IAC1B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,OAAO,MAAM,CAAC,eAAe,CAAC;QAC5B,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE;YACL,UAAU,EAAE;gBACV,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE;oBACpD,MAAM,IAAI,GAAG,eAAe,CAAC;wBAC3B,IAAI;wBACJ,KAAK;wBACL,SAAS;wBACT,IAAI,EAAE,IAA2C;wBACjD,QAAQ,EAAE,kBAAkB,EAAE;wBAC9B,QAAQ,EAAE,UAAU,EAAE;qBACvB,CAAC,CAAC;oBAEH,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;wBACpB,KAAK,aAAa;4BAChB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,OAAO;4BACV,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBAChC,KAAK,oBAAoB;4BACvB,SAAS,EAAE,CAAC,IAAI,CACd,wDAAwD,EACxD,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;4BACF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,SAAS;4BACZ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gCACpB,SAAS,EAAE,CAAC,IAAI,CAAC,yCAAyC,EAAE;oCAC1D,KAAK;oCACL,SAAS;iCACV,CAAC,CAAC;4BACL,CAAC;4BACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrB,KAAK,SAAS;4BACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAmB,CAAC,CAAC;oBAC3C,CAAC;gBACH,CAAC;aACF;SACF;KACF,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@de-otio/trellis",
-  "version": "0.10.11",
+  "version": "0.11.0",
   "license": "AGPL-3.0-or-later",
   "type": "module",
   "main": "./dist/index.js",
@@ -49,22 +49,22 @@
     "@aws-lambda-powertools/logger": "^2.32.0",
     "@aws-lambda-powertools/metrics": "^2.32.0",
     "@aws-lambda-powertools/parameters": "^2.33.1",
-    "@aws-sdk/client-cloudwatch": "^3.1066.0",
-    "@aws-sdk/client-cloudwatch-logs": "^3.1066.0",
-    "@aws-sdk/client-cognito-identity-provider": "^3.1066.0",
-    "@aws-sdk/client-dynamodb": "^3.1066.0",
-    "@aws-sdk/client-kms": "^3.1066.0",
-    "@aws-sdk/client-s3": "^3.1066.0",
-    "@aws-sdk/client-secrets-manager": "^3.1066.0",
-    "@aws-sdk/client-ses": "^3.1066.0",
-    "@aws-sdk/client-sns": "^3.1066.0",
-    "@aws-sdk/client-sqs": "^3.1066.0",
-    "@aws-sdk/client-ssm": "^3.1066.0",
-    "@aws-sdk/s3-request-presigner": "^3.1066.0",
-    "@aws-sdk/util-dynamodb": "^3.996.4",
+    "@aws-sdk/client-cloudwatch": "^3.1071.0",
+    "@aws-sdk/client-cloudwatch-logs": "^3.1071.0",
+    "@aws-sdk/client-cognito-identity-provider": "^3.1071.0",
+    "@aws-sdk/client-dynamodb": "^3.1071.0",
+    "@aws-sdk/client-kms": "^3.1071.0",
+    "@aws-sdk/client-s3": "^3.1071.0",
+    "@aws-sdk/client-secrets-manager": "^3.1071.0",
+    "@aws-sdk/client-ses": "^3.1071.0",
+    "@aws-sdk/client-sns": "^3.1071.0",
+    "@aws-sdk/client-sqs": "^3.1071.0",
+    "@aws-sdk/client-ssm": "^3.1071.0",
+    "@aws-sdk/s3-request-presigner": "^3.1071.0",
+    "@aws-sdk/util-dynamodb": "^3.996.5",
     "@de-otio/saas-foundation": "^0.3.0",
     "@de-otio/trellis-extension-api": "^0.3.0",
-    "@de-otio/vestibulum": "^0.3.0",
+    "@de-otio/vestibulum": "^0.3.2",
     "@fedify/fedify": "2.2.5",
     "@prisma/adapter-pg": "^7.8.0",
     "@prisma/client": "^7.8.0",
@@ -78,21 +78,21 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@aws-sdk/client-bedrock-agent-runtime": "^3.1066.0",
-    "@aws-sdk/client-cost-explorer": "^3.1066.0",
-    "@aws-sdk/client-ecs": "^3.1066.0",
-    "@aws-sdk/client-lambda": "^3.1066.0",
+    "@aws-sdk/client-bedrock-agent-runtime": "^3.1071.0",
+    "@aws-sdk/client-cost-explorer": "^3.1071.0",
+    "@aws-sdk/client-ecs": "^3.1071.0",
+    "@aws-sdk/client-lambda": "^3.1071.0",
     "@types/aws-lambda": "^8.10.162",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^25.9.3",
     "@types/pg": "^8.18.0",
-    "@types/sharp": "^0.31.0",
-    "@vitest/coverage-v8": "^4.1.8",
+    "@types/sharp": "^0.32.0",
+    "@vitest/coverage-v8": "^4.1.9",
     "@vitest/ui": "^4.1.8",
     "aws-sdk-client-mock": "^4.1.0",
     "esbuild": "^0.28.1",
     "form-data": "^4.0.1",
-    "mailparser": "^3.9.9",
+    "mailparser": "^3.9.11",
     "prettier": "^3.8.4",
     "prisma": "^7.8.0",
     "tsx": "^4.22.4",

package/prisma/migrations/20260620051144_add_encrypted_user_settings/migration.sql

@@ -0,0 +1,24 @@
+-- WS5 — encrypted-settings state-sync. Server-blind per-namespace encrypted
+-- setting blob with optimistic-concurrency version + cascade on user delete.
+
+-- CreateTable
+CREATE TABLE "encrypted_user_settings" (
+    "id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "namespace" TEXT NOT NULL,
+    "ciphertext" TEXT NOT NULL,
+    "version" INTEGER NOT NULL DEFAULT 1,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "encrypted_user_settings_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "encrypted_user_settings_user_id_idx" ON "encrypted_user_settings"("user_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "encrypted_user_settings_user_id_namespace_key" ON "encrypted_user_settings"("user_id", "namespace");
+
+-- AddForeignKey
+ALTER TABLE "encrypted_user_settings" ADD CONSTRAINT "encrypted_user_settings_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260620120000_add_blocked_users/migration.sql

@@ -0,0 +1,29 @@
+-- Track D — block-list store for the realtime delivery FLOOR. Directed,
+-- tenant-scoped block edges (blocker has blocked blocked). Consulted by
+-- BlockStore.isBlocked to drop a blocked sender's wakeup at the floor.
+
+-- CreateTable
+CREATE TABLE "blocked_users" (
+    "id" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "blocker_id" TEXT NOT NULL,
+    "blocked_id" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "blocked_users_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "blocked_users_tenant_id_blocker_id_idx" ON "blocked_users"("tenant_id", "blocker_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "blocked_users_tenant_id_blocker_id_blocked_id_key" ON "blocked_users"("tenant_id", "blocker_id", "blocked_id");
+
+-- AddForeignKey
+ALTER TABLE "blocked_users" ADD CONSTRAINT "blocked_users_tenant_id_fkey" FOREIGN KEY ("tenant_id") REFERENCES "tenants"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "blocked_users" ADD CONSTRAINT "blocked_users_blocker_id_fkey" FOREIGN KEY ("blocker_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "blocked_users" ADD CONSTRAINT "blocked_users_blocked_id_fkey" FOREIGN KEY ("blocked_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/schema.prisma

@@ -360,6 +360,11 @@ model User {
   notifications          Notification[]
   notificationPreference NotificationPreference?
 
+  // Realtime / server-blind settings sync
+  encryptedSettings EncryptedUserSetting[]
+  blocksInitiated   BlockedUser[]         @relation("BlockedUserBlocker")
+  blockedBy         BlockedUser[]         @relation("BlockedUserBlocked")
+
   // Connection codes (out-of-band invite mechanism)
   createdConnectionCodes  ConnectionCode[]           @relation("ConnectionCodeCreator")
   redeemedConnectionCodes ConnectionCodeRedemption[]
@@ -1748,6 +1753,7 @@ model Tenant {
   connectionCodes           ConnectionCode[]
   connectionCodeRedemptions ConnectionCodeRedemption[]
   notifications             Notification[]
+  blockedUsers              BlockedUser[]
 
   // Denormalized tenant_id on by-relation children (P1 — for direct RLS).
   postMedia           PostMedia[]
@@ -2013,3 +2019,37 @@ enum EntityRelationshipStatus {
   CONFIRMED
   REJECTED
 }
+
+// Realtime / server-blind settings sync — opaque AEAD blob the server cannot read.
+model EncryptedUserSetting {
+  id         String   @id @default(cuid())
+  userId     String   @map("user_id")
+  namespace  String // allowlisted, e.g. "feed_filters"
+  ciphertext String   @db.Text // opaque AEAD blob; the server cannot read it
+  version    Int      @default(1) // monotonic per (user, namespace)
+  updatedAt  DateTime @updatedAt @map("updated_at")
+  createdAt  DateTime @default(now()) @map("created_at")
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([userId, namespace])
+  @@index([userId])
+  @@map("encrypted_user_settings")
+}
+
+// Realtime delivery safety floor — blocked-sender relation (who blocks whom).
+model BlockedUser {
+  id        String   @id @default(cuid())
+  tenantId  String   @map("tenant_id")
+  blockerId String   @map("blocker_id")
+  blockedId String   @map("blocked_id")
+  createdAt DateTime @default(now()) @map("created_at")
+
+  tenant  Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
+  blocker User   @relation("BlockedUserBlocker", fields: [blockerId], references: [id], onDelete: Cascade)
+  blocked User   @relation("BlockedUserBlocked", fields: [blockedId], references: [id], onDelete: Cascade)
+
+  @@unique([tenantId, blockerId, blockedId])
+  @@index([tenantId, blockerId])
+  @@map("blocked_users")
+}